A computer network is a collection of interconnected computing devices that exchange data and share resources. In a packet-based network, such as the Internet, the computing devices communicate data by dividing the data into small blocks called packets, which are individually routed across the network from a source device to a destination device. The destination device extracts the data from the packets and assembles the data into its original form. Dividing the data into packets enables the source device to resend only those individual packets that may be lost during transmission.
Certain devices, referred to as routers, maintain routing information that describes routes through the network. A “route” can generally be defined as a path between two locations on the network. Upon receiving an incoming packet, the router examines information within the packet and forwards the packet in accordance with the routing information.
Large computer networks, such as the Internet, often include many routers grouped into administrative domains called “autonomous systems.” In order to maintain an accurate representation of the network, routers periodically exchange routing information in accordance with defined protocols. These routing protocols generally fall into two categories. Routers located at the edges of different autonomous systems generally use exterior routing protocols to exchange information. One example of an exterior routing protocol is the Border Gateway Protocol (BGP). Routers within an autonomous system generally utilize interior routing protocols for exchanging routing information. One example of an interior routing protocol is the Intermediate System to Intermediate System (ISIS) protocol, which is an interior gateway routing protocol for IP networks for communicating link-state information within an autonomous system. Other examples of interior routing protocols include the Open Shortest Path First (OSPF), and the Routing Information Protocol (RIP).
When two routers initially connect, they typically exchange all of their routing information. The routers send control messages to incrementally update the routing information when the network topology changes. For example, the routers may send update messages to advertise newly available routes, and to withdraw routes that are no longer available.
Conventional routers often maintain the routing information in the form of one or more routing tables or other data structures. The form and contents of the routing tables often depends on the routing algorithm implemented by the router. Furthermore, some conventional routers generate and maintain forwarding information in accordance with the routing information. The forwarding information associates network routes with specific forwarding next hops and corresponding interface ports of the router. The forwarding information may, therefore, be thought of as a subset of the routing information. The process of generating the forwarding information is generally referred to as route resolution.
A conventional router may be susceptible to a network attack, such as a denial of service (DOS) attack, which occurs when a malicious party directs a high volume of packets to the routing device in an attempt to sabotage network operation. The high traffic volume can overwhelm the routing device, leaving it unable to process the inbound packets. For example, in one type of DOS attack, a perpetrator sends a large number of “ping” requests to network broadcast addresses, which are special addresses used to broadcast messages to other devices on the network. When sending the requests, the perpetrator spoofs the source address of a routing device targeted by the attack. In response to the requests, the other network devices reply to the targeted routing device, thereby inundating the targeted routing device with packets.
Conventional approaches for prevention of network attacks typically rely on application of packet filters. A service provider network, for example, may attempt to reduce the potential for an attack on devices within the network by filtering inbound packets at the edge of the network. More specifically, the service provider may configure filters within routers along the edge of the network to selectively filter packets entering the network based on the specified destinations. The service provider may, for example, configure the filters of the edge routers to compare the destinations specified by the inbound packets with a list of internal network destinations. When matches are detected, the edge routers may drop the matching packets unless an exception or other configured policy specifies otherwise. In this manner, the filters may effectively drop malicious traffic destined for internal devices. Network traffic flowing through the service provider network, i.e., traffic that specifies a network destination external to the service provide network, is unaffected.
This technique, however, can be very tedious to implement and maintain, and may consume considerable computing and administrative resources. To be effective, these filters require an exhaustive list of destinations within the service provider network for which inbound traffic should be filtered. Moreover, each of these edge devices is typically manually configured, and must be updated whenever the internal network destinations of the service provider change. As a result, this technique can be labor intensive and prone to error, which may expose the service provider to risk of a network attack.